CanisterWorm Wiper Strikes Iranian Critical Infrastructure, Erases Data After Disabling Backups

A fresh campaign of the CanisterWorm wiper has been observed targeting Iranian government and energy‑sector networks. Attackers first compromise accounts using stolen SSH credentials and inject malicious code into legitimate software updates, gaining persistent footholds. Once inside, the malware disables backup services and then proceeds to overwrite files, effectively rendering systems inoperable.

The wipe has caused significant data loss and service outages across critical infrastructure, highlighting a supply‑chain abuse vector and the danger of inadequate credential hygiene. Defenders must prioritize detection of unauthorized SSH logins, enforce strict code‑signing and update verification, and adopt immutable, offline backups to mitigate the impact of similar wiper attacks.

Categories: Malware & Ransomware, Threat Intelligence

Source: Read original article